mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-03-03 14:32:16 +02:00
h264: correct ref count check and limit, fix out of array accesses.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
parent
2d5f1addbe
commit
d6c184880e
@ -2935,7 +2935,7 @@ static int decode_slice_header(H264Context *h, H264Context *h0)
|
|||||||
h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
|
h->ref_count[1] = get_ue_golomb(&s->gb) + 1;
|
||||||
else
|
else
|
||||||
// full range is spec-ok in this case, even for frames
|
// full range is spec-ok in this case, even for frames
|
||||||
max[1] = 31;
|
h->ref_count[1] = 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){
|
if (h->ref_count[0]-1 > max[0] || h->ref_count[1]-1 > max[1]){
|
||||||
|
Loading…
x
Reference in New Issue
Block a user